To remove your data,
we first have to hold it.

01Who this notice is from

ObscureIQ is a protective intelligence company. We protect high-risk people and organizations from digital threats that can become real-world harm.

The entity responsible for the personal data described in this notice, and the controller of it under the laws that use that word, is Avantis Data Solutions LLC, doing business as ObscureIQ, a Pennsylvania limited liability company, with its registered address at 100 Adios Drive, Suite 1123, Washington, PA 15301.

Throughout this notice, ObscureIQ means that entity. Where we say "you", we mean whoever is reading: a visitor to this website, somebody who contacts us, a client, or a person whose information reaches us in the course of protecting somebody else. Each of those is covered, and section 07 is about the last one.

02The rights you have

We grant every person the full set of rights below, wherever you live, whatever your nationality, and whether or not any particular law would require us to.

This is deliberate, and it is the one place a notice from this firm should not read like everyone else's. Most notices sort readers by jurisdiction and hand out different rights accordingly. A company that sells data minimization and then gives a reader in one state fewer rights than a reader in another has made an argument against itself. So the strictest standard we are subject to anywhere is the standard we apply to everybody.

We will not charge you for exercising any of these, we will not make you create an account to do it, and we will not treat you differently afterwards. If we ever refuse a request we will say which exception we are relying on and why, in writing. Section 14 says how to ask.

03The website

This website sets no cookies, runs no analytics, and keeps no record of who you are.

Specifically, and as of the date on this notice:

• No cookies are set. None, of any kind, by us or by anyone else. There is no cookie banner because there is nothing to consent to.
• No analytics. There is no Google Analytics, no tag manager, no Plausible, Fathom, Matomo or Simple Analytics, no session recorder and no heatmap. The only record of a visit is the server log described below.
• No third-party requests. Fonts, stylesheets, scripts and images are all served from this domain. Earlier versions of this site loaded fonts from Google, which disclosed your IP address and browser to Google on every page view. They no longer do, and nothing has replaced them.
• No advertising or social pixels. No Meta pixel, no LinkedIn insight tag, no conversion tracking.
• No embedded players or widgets. Where we point at a video we link out to it rather than embed it, so nothing loads until you decide to go.

Server logs

Our host records standard web server logs, which include IP addresses, for the narrow purpose of serving the site and defending it against attack. They are kept for 30 days and then discarded. These logs are never joined to anything else, never used to analyse visitors, and never shared unless the law requires it, for example under a subpoena.

Pages we do not index

Some pages on this site are reached by invitation rather than by search, and we ask search engines not to index them. That is a courtesy to the people we send them to, not a security measure. Treat any URL you are given as shareable by anyone who has it.

04When you contact us

First contact can be anonymous, and we would often rather it was. Whatever you send is deleted within 60 days of our answering it, unless you ask us to keep the thread open.

The contact page describes each channel and what it leaves behind. Email is the least private, because mail crosses providers neither of us controls.

• The form on this site. It posts to a handler that sends us the message and stores nothing. The only personal data involved is the address you choose to give us, and whatever you choose to put in the message.
• Email to info@obscureiq.com. Handled by Google Workspace. A temporary or forwarding address is fine and is not treated as suspicious.
• Signal. End to end encrypted, and the right choice if a record of the approach should not exist.

Across all three: we reply only through the channel you opened, and never through another. Your first message does not need to contain the sensitive part. Name the situation, not the particulars.

Inbound messages pass an automated filter that screens for abuse. That filter reads the message to decide whether it is abuse, and nothing else, and it does not profile you or build a record of you.

Retention. Messages are deleted within 60 days of delivery unless you ask for follow-up. If a conversation becomes an engagement, section 09 takes over.

05What an engagement requires

An engagement is the opposite of the website. To find what an adversary can find about you, we have to assemble it, which means that for the duration of the work we hold a fuller picture of you than almost anyone else does.

There is no version of this work that avoids it. You cannot remove a record you have not located, you cannot locate it without searching under the identifiers that index it, and you cannot tell a client which exposures matter without knowing which ones connect. We would rather state that plainly than bury it.

What you give us

• Identity and contact. Legal name, former names and aliases, date of birth, current and former addresses, phone numbers, and email addresses.
• Household and connections. The people whose exposure affects yours: spouse, children, others in the residence, and the staff and advisors who sit close to you. See section 07, because they have rights of their own.
• Assets and filings. Property, entities, registrations and public filings that carry your name or address.
• Accounts. The usernames, handles and email addresses that anchor your online presence.
• The situation. Whatever you tell us about the threat, which is often the most sensitive thing in the file and is held accordingly.

What we collect about you from elsewhere

This is the part most people do not expect. To map your exposure we gather information about you from sources you never gave us:

• Data brokers and people-search services, to see what they are publishing about you and what it enables.
• Public records, including property, court, corporate and voter filings where those are public.
• Social platforms and open web sources, for what is findable about you and the people around you.
• Breach and leak sources, including dark and deep web sources, to establish which of your credentials and identifiers are already circulating.
• Our own indexes, which are described in section 07.

We do this under the engagement you have signed, and because it is the only way to deliver what you hired us for. We do not use any of it to build a profile for any purpose other than protecting you, we do not combine it with other clients' data, and we do not sell it. Ever, to anyone, at any price. That is not a policy we could change quietly: it is the whole premise of the firm.

06The part other firms leave out

To get a record about you taken down, we have to prove to the holder that the record is about you. That means handing your identifiers to a company whose business is collecting them.

Under the laws that use these words, we act as your agent when we make these requests. Each holder is an independent controller of what it already holds. We do not control what a holder does with its records; reducing what they hold is the job we are hired to do.

07People who are not our clients

Protecting one person means holding information about others. This section is for them. Which part applies to you is decided by your role in the matter, not by your relationship to the client, because the same person can be either.

If we hold your data in order to protect you

Exposure runs through a household. A client's address can be published through a spouse's filing or a child's school listing, so the work covers the people around the client: spouse, others in the residence, and the staff and advisors who sit close. We process your information on the client's instruction and in the household's shared interest in not being findable, and we use it only to reduce exposure.

The rights in section 02 are yours in full. You can ask us directly, under section 14, what we hold about you and where it came from, have it corrected or deleted, or tell us to stop. You do not need the client's permission to ask, and we will not tell the client that you did unless you want us to, or the law requires it. If you would rather not be covered at all, say so: we will take you out of the work, and the client will be told only that coverage of the household is now partial, not who asked.

If we hold your data because you are the threat

Where we investigate hostile attention, we necessarily process information about the people directing it. We do this on the basis of legitimate interests: the protection of a person facing a credible threat, weighed against the privacy interests of the person generating it. We hold it to the same standard as everything else, we do not publish it, and we do not pass it to anyone but the client and, where the client directs, their counsel and the relevant authorities, unless the law requires us to.

Some of the rights in section 02 cannot be granted here without defeating the purpose, and the laws that grant them say so: each allows a holder to decline where disclosure would compromise the safety or rights of another person, where the information is needed to establish or defend a legal claim, or where legal process applies. So if you ask, we will acknowledge your request within the time section 14 promises, we will neither confirm nor deny that an investigation exists, and where we decline a request we will say in writing which exception we are relying on. We give that same answer to anyone whose role in a matter we cannot disclose, so the answer itself tells you nothing about whether there is a file.

Our indexes and research

• CODEX is an index of the companies that collect, trade and monetize personal information. It describes corporate entities, their ownership and their infrastructure. It is not an index of individuals.
• The Circulating Breaches corpus records breaches: what was exposed, which fields, how it happened, and whether the data is in circulation. We track which compromised data is actively circulating on the dark web and on hacking forums, which is what lets us assess the real risk of an exposure rather than the announced one. The corpus holds summaries and analysis of each breach. It does not hold the breached data itself, and it holds no personal data.
• Published research names public figures and companies where the analysis requires it, on the same footing as journalism, and does not name private individuals.

08Who else sees any of this

We do not sell personal information, we have never sold it, and we do not share it for cross-context behavioral advertising. There is no "do not sell" link on this site because there is nothing to opt out of.

The firm's own conduct standard, published on the About page, is the operative commitment:

Beyond that, your information reaches only:

• The holders of records about you, to the extent section 06 describes, and only on your instruction.
• Your counsel, where you direct it. Where work is directed by counsel it may be covered by privilege, depending on how the engagement is structured.
• Authorities, where you ask us to involve them, or where we are compelled by valid legal process. If we are compelled, we will tell you before we comply unless we are legally forbidden from doing so, and we will narrow the response to what the process actually demands.
• A short list of infrastructure providers that host and secure our systems. By category: cloud hosting and storage, email and productivity software, encrypted communications, and the systems in which engagement files and work product are kept. They are bound by contract, they process only on our instruction, and none of them are permitted to use anything for their own purposes.

If the firm were ever acquired or merged, personal data could transfer as part of it. In that event we will say so here before it happens, and anyone who would rather have their data deleted than transferred can ask, and we will delete it before the transfer.

09How long we keep it

We keep as little as the work allows and for as short a time as we can defend. Holding data we no longer need is the exact risk we exist to reduce.

• Website visits. Nothing beyond the server logs. Server logs are discarded after 30 days.
• Inbound messages. Deleted within 60 days of delivery, unless you ask for follow-up.
• Engagement data, during the engagement. Held for as long as the work requires it.
• Engagement data, after it ends. Deleted within 30 days of the engagement ending, unless the engagement agreement says otherwise.
• Work product and briefs. Numbered and archived, because a finding you may need to rely on later is worth nothing if we have thrown away the basis for it. Archived material is reduced to what the finding rests on.

Deletion means deletion from live systems immediately and from backups as those backups cycle. We will tell you when that cycle completes rather than claim an instantaneous erasure that no backup system performs.

The narrow exceptions where we may keep something after you ask us to delete it: where we are legally required to retain it, where it is needed to establish or defend a legal claim, and where deleting it would compromise an active protective matter for somebody else. We will name which one applies.

10How it is protected

Encrypted channels, access on a need to know basis, and systems reviewed and hardened on an ongoing basis.

The Data Security Statement sets out the programme in full, including where our SOC 2 readiness work stands. In practical terms: intake is encrypted, client data is encrypted in transit and at rest where appropriate to the system and the information involved, access is limited to the analysts working your matter, and the firm's internal indexes, pipelines and monitoring run on infrastructure we control rather than on an off-the-shelf platform.

No one can promise that a system cannot be breached, and a firm that catalogues breaches for a living is the last that should try. What we will commit to is this: if personal data we hold is exposed, we will tell the people affected directly and promptly, we will say what was taken rather than describe it vaguely, and we will say what we are doing about it. We will not wait for a regulator's deadline to decide whether to tell you.

11Scores, and what they decide

Nothing about you is decided by a model on its own.

We publish several measures. The Threat Surface Index scores how exposed a person is. The Hostility Index scores how much hostile attention a person generates. The Breach Risk Index scores what a breach enables. Clients see these, and they are designed to make a year of work measurable against a number written down on day one.

None of them produces a decision by itself. Every finding that reaches a client is analyst reviewed, every brief states its confidence, and the scores inform judgment rather than replacing it. You have the right to ask how a score about you was arrived at, and to contest it, and section 14 is how.

12Children

We do not hold the personal data of children, we do not market to them, and this website is not directed at them.

We do not knowingly collect personal data from anyone under 18, and no engagement file holds a minor's data. Where a client's exposure runs through a child, for example an address published through a school listing, the record we act on is the client's, and we do not build a file on the child. The one thing we offer that involves minors is training, arranged through a parent or guardian, and it requires no personal data from the minor to deliver. If you believe we hold information about a child, tell us under section 14 and we will delete it.

13Changes to this notice

When this notice changes we will say what changed, not merely that something did.

The date at the top is the date this version took effect. Material changes, which means anything that widens what we collect, what we do with it, or who sees it, will be announced on this page at least 30 days before they take effect, and the previous version will stay available for comparison. Where we hold a current email address for you, or where the law where you live requires it, we will also tell you directly. Changes that narrow those things, or that only correct wording, take effect when posted.

14How to reach us about this notice

One address, answered by a person, and you do not have to prove who you are before we will talk to you.

We will ask for enough to be confident we are not disclosing your information to somebody else, which for an access or deletion request usually means confirming control of an address or number already in the file. We will not demand identity documents in order to answer a question.

We review and answer privacy requests and questions under the strictest standard or law we are subject to, whichever that is for the request in front of us.

If you want to appeal a decision we have made about a privacy request, send the appeal to the same address, mark it "Privacy Rights Appeal", and include enough for us to identify the original request. We will look at it again. You also have the right to complain to a data protection authority where you live, and nothing in this notice asks you to give that up.